Mistral Security Log Analyzer

A small Python command-line application that sends local security logs to the Mistral AI API and produces a structured JSON security assessment.

Important: simulated data

security_logs.txt is entirely simulated test data created for this project. It contains deliberately constructed attack patterns such as brute-force authentication, privilege escalation, port scanning, suspicious command execution, and unusual file access.

Do not treat these logs as real security data. Do not use them to make production security decisions.

Features

• Reads logs from a local text file.
• Uses the official mistralai Python SDK.
• Sends the logs as untrusted data to a Mistral chat completion.
• Requests JSON mode with:
  • summary
  • findings
  • severity
  • evidence
  • recommendations
  • confidence
• Validates that AI-provided evidence is copied exactly from the original log file.
• Prints a readable terminal report.
• Saves the validated report to security_analysis.json.
• Keeps the API key out of source code.
• Handles missing files, missing API keys, API failures, malformed JSON, and invalid model output.

Requirements

• Python 3.10 or newer.
• A Mistral AI API key with API access enabled.
• Internet access for the API request.

The project targets Mistral's current Python SDK 2.x. The official SDK is installed as mistralai. Mistral's documentation recommends the official SDK and documents JSON mode with response_format={"type": "json_object"}.

Run

With the included simulated logs:

python security_analyzer.py

The command reads security_logs.txt and writes:

security_analysis.json

You can analyze another local file:

python security_analyzer.py --log-file /path/to/security.log

You can choose a different output file:

python security_analyzer.py --log-file security_logs.txt --output my_analysis.json

You can select a model:

python security_analyzer.py --model mistral-large-latest

Output

The terminal report contains:

• Overall severity and confidence.
• A summary.
• Each finding's title and explanation.
• Exact supporting log entries.
• Severity and confidence for each finding.
• Practical recommendations.

security_analysis.json contains the same complete structured assessment.

A finding has this general shape:

{
  "title": "Repeated SSH authentication failures",
  "description": "Multiple failed logins from the same source ...",
  "severity": "High",
  "evidence": [
    "2026-08-28T11:10:00Z src_ip=... "
  ],
  "recommendations": [
    "Review the source IP and block it if unauthorized."
  ],
  "confidence": "High"
}

Security considerations

• Never hard-code an API key.
• Never commit a real .env file or secret.
• Review logs for personally identifiable or confidential information before sending them to an external AI service.
• The application limits a single request to 5,000 non-empty log lines. Large production log sets should be processed in carefully designed batches.
• Logs are explicitly treated as untrusted data in the prompt to reduce the risk of log-injection or prompt-injection content influencing the analysis instructions.
• AI analysis is advisory. Verify important findings against trusted telemetry before taking disruptive action.
• The application only accepts evidence that exactly matches a line in the supplied log file. This reduces, but does not eliminate, the risk of unsupported evidence.
• The application does not execute commands found in the logs.

Project structure

mistral_security_log_analyzer/
├── security_analyzer.py
├── security_logs.txt
├── requirements.txt
├── .env.example
├── README.md
└── security_analysis.json   # created after a successful run

Troubleshooting

MISTRAL_API_KEY is not set

Set the environment variable in the same shell where you run the program.

401 Unauthorized

The API key may be invalid or unavailable to the process.

402 Payment Required

The Mistral API account may require billing/API access to be enabled.

429 Too Many Requests

The API rate limit may have been reached. Wait and retry.

Mistral returned malformed JSON

The application uses Mistral JSON mode and also validates the result. If a response still fails validation, inspect the error and retry. The application deliberately refuses to save unvalidated analysis.

Disclaimer

This repository is provided for educational and research purposes only.

AI-generated results may be incomplete, inaccurate, or incorrect. The results should not be considered proof that a system is vulnerable or secure.

Use this project at your own risk. The author is not responsible for any damage, data loss, security incident, service interruption, or other consequences resulting from the use of this project, its code, or its results.

Always validate findings using appropriate security tools and your organization's security procedures before taking action in a production environment.